NFT Trader Hack

NFT Trader is a peer-to-peer platform where people swap NFTs and tokens directly with each other. To trade, users approved its contracts to move their NFTs. On 16 December 2023, an attacker found a bug in how some older NFT Trader contracts handled trades, which let them take NFTs from any wallet that still had approvals to those contracts. The team had no way to pause the old contracts, and other attackers soon copied the exploit to take NFTs of their own.

The main attacker took close to $3M worth of NFTs, mostly Bored Apes and Mutant Apes, and also claimed over 113,000 ApeCoin that had been staked with the stolen apes. Other attackers took NFTs such as Cool Cats and Art Blocks Squiggles. After the main attacker demanded a ransom, Boring Security DAO and Yuga Labs negotiated the return of 36 Bored Apes and 18 Mutant Apes for a 120 ETH bounty, about 10% of their value, paid by Yuga Labs co-founder Greg Solano. The apes were then returned to their owners free of charge.

The ApeCoin was never returned, and NFTs worth over $100k stayed with the other attackers. Counting the bounty, attackers kept around $600k in value. NFT Trader asked users to revoke all approvals to its old contracts. If you ever traded on NFT Trader, check for approvals to these contracts and revoke them. Revoking protects what is still in your wallet, but it does not recover NFTs or tokens that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.